CVE Intelligence
Analysis AI-assisted

CVE-2020-37065: StreamRipper32 2.6 Buffer Overflow via SongPattern Input

StreamRipper32 version 2.6 is described as containing a buffer overflow in the Station/Song section, reachable through the SongPattern input. The record provider, VulnCheck, scores it critical at CVSS 3.1 9.8, and the description says it could potentially allow arbitrary code execution. The record shows no KEV listing, no EPSS data and no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

StreamRipper32 version 2.6 is described as containing a buffer overflow in its Station/Song section. According to the description, the SongPattern input can be manipulated so that memory is overwritten, and a payload longer than 256 bytes is said to potentially allow arbitrary code execution. The weakness is classified as CWE-120 (Classic Buffer Overflow).

Impact

  • Confirmed by the record: the vulnerability class is a buffer overflow that can overwrite memory.
  • According to the description, successful exploitation could potentially lead to arbitrary code execution and compromise of the application.
  • The CVSS 3.1 base score of 9.8 (critical) and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H are attributed to disclosure@vulncheck.com in the record. The vector describes network reachability, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact.
  • A CVSS 4.0 score of 8.4 is also listed from the same provider.

Affected products and versions

  • Product: StreamRipper32.
  • Version named in the description: 2.6.
  • The structured affected list in the record is empty, so the full range of affected versions is unknown.
  • The project homepage is listed in the references: StreamRipper project page

Exploitation status

  • The record marks the CISA KEV entry as not listed. No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
  • The record lists an Exploit-DB entry among its references: Exploit-DB reference. The presence of a public reference does not by itself confirm exploitation in the wild, and its contents are not reproduced here.
  • EPSS data is not available in the record.

Remediation and mitigation

  • No fixed version is listed in the record. This does not mean no fix exists; the status of a fix is unknown.
  • Check the upstream project and vendor channels for an updated release or advisory before deploying.
  • If no update is available, consider removing or replacing the software with a maintained alternative.
  • Limit exposure: run the application only where it is needed, restrict network access to it, and avoid feeding it untrusted station or song metadata.
  • Apply least privilege to the account running the application to reduce the impact of a compromise.

Detection guidance

  • Watch for unexpected crashes, restarts or abnormal terminations of the application, which can accompany memory corruption.
  • Review logs and metadata sources for unusually long or malformed station or song entries.
  • Monitor for unexpected child processes or outbound connections originating from the application host.
  • These are high-level indicators; the record does not describe specific artifacts.

Limitations of the available information

  • The record title is empty, so titles were written from the description.
  • The vulnerability is described by a third party (VulnCheck) and the record carries a source status of Deferred.
  • The description does not specify the exact vulnerable code path, the platforms tested, or whether later releases fix the issue.
  • The description states potential code execution; the record does not confirm whether this is achievable in practice.
  • The CVSS 3.1 and 4.0 scores come from the provider named in the record, not from an official assessment included in the data provided.

Frequently asked questions

Is CVE-2020-37065 known to be exploited?

The record marks the CISA KEV entry as not listed, and no confirmed active exploitation appears in the sources consulted. A public Exploit-DB reference is listed, but that alone does not confirm exploitation in the wild.

Which versions are affected?

The description names version 2.6. The structured affected list is empty, so the full range of affected versions is unknown.

Is a fixed version available?

No fixed version is listed in the record. The absence of a listed fix does not mean none exists, so check the upstream project and vendor channels.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.